Plugin icon

Popup Box – Create Countdown, Coupon, Video, Contact Form Popups

ays-popup-box

Vulnerabilities:

18

Last Updated:

March 31, 2026

Active Installs:

50000

Published
Title
Fixed in
CVSS
Published
2026-03-17
Title
Popup Box AYS Pro < 5.5.0 - Admin+ Stored Cross-Site Scripting (XSS) via CSRF
Fixed in
Fixed in 5.5.0
CVSS
6.1 (medium)
Published
2026-01-30
Title
Popup Box < 6.1.2 - Cross-Site Request Forgery to Popup Status Change
Fixed in
Fixed in 6.1.2
CVSS
4.3 (medium)
Published
2025-12-28
Title
Popup box < 6.0.8 - Cross-Site Request Forgery
Fixed in
Fixed in 6.0.8
CVSS
4.3 (medium)
Published
2025-10-29
Title
Popup box < 5.5.5 - Cross-Site Request Forgery
Fixed in
Fixed in 5.5.5
CVSS
4.3 (medium)
Published
2024-11-15
Title
Popup Box – Create Countdown, Coupon, Video, Contact Form Popups < 4.9.8 - Missing Authorization to Unauthenticated Limited Options Update
Fixed in
Fixed in 4.9.8
CVSS
5.3 (medium)
Published
2024-09-03
Title
Popup Box < 4.7.8 - Admin+ Stored XSS
Fixed in
Fixed in 4.7.8
CVSS
3.5 (low)
Published
2024-06-20
Title
Popup box < 4.5.2 - Missing Authorization
Fixed in
Fixed in 4.5.2
CVSS
4.3 (medium)
Published
2024-05-03
Title
Popup box < 4.1.3 - Cross-Site Request Forgery
Fixed in
Fixed in 4.1.3
CVSS
6.1 (medium)
Published
2024-04-24
Title
Popup Box – Best WordPress Popup Plugin < 4.3.7 - Missing Authorization to Information Exposure
Fixed in
Fixed in 4.3.7
CVSS
5.3 (medium)
Published
2024-01-22
Title
Popup Box Pro < 7.9.0 - Admin+ Stored XSS
Fixed in
Fixed in 7.9.0
CVSS
3.5 (low)
Published
2024-01-22
Title
Popup Box Pro < 20.9.0 - Admin+ Stored XSS
Fixed in
Fixed in 20.9.0
CVSS
3.5 (low)
Published
2023-11-13
Title
Popup box < 3.8.6 - Admin+ Stored XSS in Categories
Fixed in
Fixed in 3.8.6
CVSS
3.5 (low)
Published
2023-11-13
Title
Popup box < 3.8.6 - Admin+ Stored XSS in Popup Settings
Fixed in
Fixed in 3.8.6
CVSS
3.4 (low)
Published
2023-10-27
Title
Popup Box < 3.7.9 - Admin+ Stored XSS
Fixed in
Fixed in 3.7.9
CVSS
3.5 (low)
Published
2023-08-29
Title
Popup box < 3.7.2 - Admin+ Stored Cross-Site Scripting
Fixed in
Fixed in 3.7.2
CVSS
3.5 (low)
Published
2023-03-08
Title
Popup box < 3.4.5 - Reflected XSS
Fixed in
Fixed in 3.4.5
CVSS
7.1 (high)
Published
2021-06-29
Title
Popup box < 2.3.4 - Authenticated Blind SQL Injections
Fixed in
Fixed in 2.3.4
CVSS
7.6 (high)
Published
2021-06-29
Title
Multiple Plugins from AYS Pro - Reflected Cross-Site Scripting (XSS)
Fixed in
Fixed in 2.3.4
CVSS
7.1 (high)